remcos | b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c

Sharing

Copy URL Twitter E-mail

General

Target
b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c
Size 633KB
Sample260930-yy59mass8k
SHA256 b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c
MD5 7ee92b478819b0649e49468131f2b2cb
SHA1 fad786b97e73220e19385c0a5134608eee94bcb7
SHA512 96161716933397ee9e6d71148ee3614bf418777420fa456c87bb848f568c158afc3e3b8b54fd7c025eac42d38bc9b47676721826583673169069226d6e9bae7a
SSDEEP 12288:0SGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:RGuNF0MV/VSU5+1yhHaaPX6P/trZ5
TLSH
T13FD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

marzo 2026 rat remcos

Malware Config

Extracted

Family

remcos

Version

7.2.0 Pro

Botnet

MARZO 2026

actualizadoswin11.kozow.com:6000

Attributes

audio_folder
MicRecords
audio_path
ApplicationPath
audio_record_time
5
connect_delay
0
connect_interval
1
copy_file
windows11.exe
copy_folder
windows11
delete_file
false
hide_file
false
hide_keylog_file
false
install_flag
true
keylog_crypt
false
keylog_file
logs.dat
keylog_flag
false
keylog_folder
Windows11
mouse_option
false
mutex
Windows11-9DW3HY
screenshot_crypt
false
screenshot_flag
false
screenshot_folder
Screenshots
screenshot_path
%AppData%
screenshot_time
10
take_screenshot_option
false
take_screenshot_time
5

Signatures

Family: Remcos
Remcos is a closed-source remote control and surveillance software.
rat remcos

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c

File Explorer

b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c

.exe 633KB

b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c

IMPHASH f4e833c94f979b4a69174b78399e4f22
SHA256 b2002839865483253973888a9ad3b8ace46f849861a6d7d4725cd3dd298f3b1c
MD5 7ee92b478819b0649e49468131f2b2cb
SHA1 fad786b97e73220e19385c0a5134608eee94bcb7
SHA512 96161716933397ee9e6d71148ee3614bf418777420fa456c87bb848f568c158afc3e3b8b54fd7c025eac42d38bc9b47676721826583673169069226d6e9bae7a
SSDEEP 12288:0SGuIuF0MV/VSU5s11yuTUHaaPC+6P/to0Z5Qxr:RGuNF0MV/VSU5+1yhHaaPX6P/trZ5
TLSH
T13FD45C55A3D442F8D07BC135C9828527E7F2BC056671872F03D74E5B6F232A1AF2AB26
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

296636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW CreateToolhelp32Snapshot Process32NextW Process32FirstW GetLongPathNameW CopyFileW InitializeCriticalSection GetLocaleInfoA VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcessHeap FreeLibrary IsBadReadPtr GetTempPathW OpenProcess lstrcatW GetCurrentProcessId GetTempFileNameW GetSystemDirectoryA GlobalAlloc GlobalLock GetTickCount GlobalUnlock LocalAlloc GlobalFree MulDiv SizeofResource QueryDosDeviceW FindFirstVolumeW GetConsoleScreenBufferInfo SetConsoleTextAttribute lstrlenW GetStdHandle SetFilePointer FindResourceA FormatMessageW LockResource LoadLibraryW LoadResource LocalFree MoveFileExW FindVolumeClose GetVolumePathNamesForVolumeNameW lstrcpyW SetConsoleOutputCP FormatMessageA FindNextVolumeW AllocConsole FindNextFileA WriteProcessMemory Wow64SetThreadContext Wow64GetThreadContext GetThreadContext SetThreadContext ResumeThread GetModuleFileNameA lstrcpynA QueryPerformanceFrequency QueryPerformanceCounter DeleteCriticalSection SetEndOfFile HeapSize WriteConsoleW SetStdHandle SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExA HeapReAlloc ReadConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers GetFileType GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetACP GetModuleHandleExW LoadLibraryExW RaiseException RtlPcToFileHeader RtlUnwindEx GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW DecodePointer EncodePointer TlsFree TlsSetValue TlsGetValue FindFirstFileA GetFileSize TerminateThread GetModuleHandleA RemoveDirectoryW MoveFileW SetFilePointerEx GetLogicalDriveStringsA CreateDirectoryW DeleteFileW ExpandEnvironmentStringsA DeleteFileA GetLastError SetFileAttributesW GetFileAttributesW FindClose lstrlenA GetDriveTypeA FindNextFileW GetFileSizeEx FindFirstFileW GetModuleHandleW ExitProcess GetProcAddress OpenMutexA CreateMutexA GetCurrentProcess CreateProcessA PeekNamedPipe CreatePipe TerminateProcess ReadFile CreateEventA GetLocalTime CreateThread SetEvent CreateEventW WaitForSingleObject Sleep CloseHandle ExitThread CreateFileW LeaveCriticalSection WriteFile EnterCriticalSection lstrcmpW TlsAlloc SwitchToThread GetStringTypeW MultiByteToWideChar WideCharToMultiByte InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx ResetEvent InitializeCriticalSectionAndSpinCount RtlUnwind

user32

SetForegroundWindow SetClipboardData EnumWindows ExitWindowsEx EmptyClipboard ShowWindow SetWindowTextW MessageBoxW IsWindowVisible CloseWindow SendInput EnumDisplaySettingsW mouse_event MapVirtualKeyA DrawIcon GetSystemMetrics TrackPopupMenu TranslateMessage DispatchMessageA GetMessageA GetWindowTextW wsprintfW GetClipboardData UnhookWindowsHookEx GetForegroundWindow ToUnicodeEx GetKeyboardLayout SetWindowsHookExA CloseClipboard OpenClipboard GetKeyboardState CreatePopupMenu CreateWindowExA AppendMenuA RegisterClassExA GetWindowTextLengthW GetKeyState GetKeyboardLayoutNameA CallNextHookEx GetCursorPos SystemParametersInfoW GetIconInfo GetWindowThreadProcessId DefWindowProcA

gdi32

BitBlt SelectObject CreateCompatibleDC StretchBlt GetDIBits DeleteDC DeleteObject CreateDCA GetObjectA CreateCompatibleBitmap

advapi32

AdjustTokenPrivileges CryptAcquireContextA CryptGenRandom CryptReleaseContext GetUserNameW RegEnumKeyExA GetTokenInformation QueryServiceStatus CloseServiceHandle OpenSCManagerW OpenSCManagerA ControlService StartServiceW QueryServiceConfigW ChangeServiceConfigW OpenServiceW EnumServicesStatusW RegDeleteKeyA LookupPrivilegeValueA OpenProcessToken RegQueryInfoKeyW RegQueryValueExA RegCreateKeyExW RegEnumKeyExW RegSetValueExW RegSetValueExA RegOpenKeyExA RegOpenKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegQueryValueExW RegCreateKeyA RegCloseKey

shell32

ShellExecuteExA Shell_NotifyIconA ExtractIconA ShellExecuteW

ole32

CoGetObject CoUninitialize CoInitializeEx

shlwapi

PathFileExistsW StrToIntA PathFileExistsA

winmm

waveInStop waveInPrepareHeader waveInUnprepareHeader PlaySoundW mciSendStringA waveInOpen waveInStart mciSendStringW waveInAddBuffer waveInClose

ws2_32

recv connect socket send WSAGetLastError WSASetLastError inet_addr gethostbyaddr getservbyport ntohs getservbyname htonl htons inet_ntoa closesocket gethostbyname WSAStartup

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

gdiplus

GdipLoadImageFromStream GdipSaveImageToStream GdipGetImageEncodersSize GdiplusStartup GdipGetImageEncoders GdipCloneImage GdipAlloc GdipDisposeImage GdipFree

wininet

InternetOpenUrlW InternetOpenW InternetCloseHandle InternetReadFile